Profile picture
C. Shawn Eib @realShawnEib
, 17 tweets, 11 min read Read on Twitter
After the threads from @conspirator0 and @propornot re: @propornotapp (now suspended), decided to look for any interesting breadcrumbs they may have left behind. Wound up learning about #Nationalist parties of Bulgaria and a few other tidbits. #osint #bots #disinformation
First thing that turned up was this article from the site newsbeezer(.)com (site title: Bulgaria Evening News). As you can see in the screenshot, @PropOrNotApp is quoted discussing conditions during fires in neighboring Greece. Sure, why not?
What else is on this site? Well, they appear to be big fans of the National Front for the Salvation of Bulgaria, normally abbreviated to NFSB, though oddly they seem to alternate the abbreviation between NFFS and NPSB. Neither appear affiliated with another political party.
The NFSB is a member of the current ruling coalition in Bulgaria, called the United Patriots. The United Patriots are aligned with the nominally Pro-EU GERB party but that position has lost some of its strength due to the alliance. Here’s a quick look at UP’s positions and makeup
So what is the NFSB all about? Let’s see: first pic is a quote from NFSB’s leader re Roma. He’s a deputy PM. Good lord. Second was a EU-skeptic coalition of parties they were a member of, along with #UKIP of #Brexit fame. So pro-Kremlin, anti-EU, anti-immigrant, nationalist. Hmm.
So who’s behind this site? It’s hosted in the US by Namecheap and registered anonymously, but there’s a clue left in the Start of Authority or SOA DNS record: the email address rockpura786@gmail(.)com. This email is in two other domains records, vaaju(.)com and remonews(.)com
SOA, or Start of Authority, records are part of the system that allows you to type “” instead of an IP address, known as DNS. This particular records tells you the contact for DNS problems. Since they’re using Namecheap with custom servers, that’s them.
Vaaju(.)com might have some slight bias behind it; remonews(.)com less obviously so, but not radically different. First pics are vaaju(.)com and second are remonews(.)com’s current headlines.
Remember the odd use of NFFS for the NFSB party? First relevant result found (nothing else seemed to be referencing a Bulgarian political party). Also they credit Descant as the author, which is the NFSB newspaper. Possibly avoiding detection of content scraping?
So far no additional information as to the identity of the person/organization using that email, but if anything else is found I’ll add it to this thread.
The @PropOrNotApp account stood out in tweets collected through May in this research paper for its use of the hashtag #fakenews, though they falsely believe it to be associated with the @propornot effort.…
Between the email address found in all three sites, the dates at which they went live (April 2018), common infrastructure (all use Namecheap and WhoisGuard), similar messaging, and reuse of website templates, the shared ownership of these sites is fairly obvious.
So the question is what if any affiliation exists between @PropOrNotApp and the creator of these sites? The account was created to spread mis/disinformation about people studying the same. Their being quoted by a site, one of a few run by the same person(s), pushing the type of
#Disinformation that @propornot works to expose seems suspicious but could be as simple as two like minded people, and the writer of this article followed @ProporNotapp. With the account suspended, I haven’t found the full text yet. If anyone wants to share, my DMs are open :)
Regardless the look into Kremlin-aligned far-right parties was interesting, and a good reminder that information is just weaponized against America; our friends and allies are under attack as well. So thank you to @conspirator0 and @propornot for a fun night!
All articles from thread (visit at your own risk, can’t guarantee there’s nothing malicious on them)………
Isn’t!!! @twitter please, flag em as such if you want, but give us a damn edit button!!!
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to C. Shawn Eib
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member and get exclusive features!

Premium member ($30.00/year)

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!